Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone have a working implementation using keyfiles, preferably on SD Card, instead of a prompt for ZFS? I know how to do this with linux LVM/LUKS. In my opinion the FreeBSD full disk encryption solutions are WAY more secure, but I would really like to use keyfiles instead of getting prompted during boot.

I can't find a way to do it with google-magic.

share|improve this question
up vote 6 down vote accepted

You have to create your key first. ZFS supports two types of file based keys. Hex, and raw. For this you can use openssl to generate the key.

openssl rand -out /media/stick/key 16

The 16 creates a 16-byte (i.e., 128-bit) key. For a 192-bit or 256-bit key use 24 or 32 respectively.

Then create your dataset as you normally would, specifying the key.

zfs create -o encryption=on -o keysource=raw,file:///media/stick/key rpool/encrypted

You can also use the -hex flag to openssl rand and keysource=hex for a human readable hex value in the file.

share|improve this answer
Thank you. You have been most helpful. Once I get it tested and working on my particular implementation I'll hit check. Again, thanks. – RobotHumans Aug 19 '11 at 17:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.